一句话：本文实证代码混淆会损害杀毒引擎的数据集标注，并筛选抗混淆引擎以提升恶意软件检测性能。
基于机器学习的 Android 恶意软件检测依赖高质量数据集，而现有大规模数据集多通过 VirusTotal 聚合所有杀毒引擎的决策来标注，未考虑引擎差异。代码混淆会不同程度降低引擎检测能力，因此不加区分地接受所有引擎并不可靠。本文先以数据驱动方式证实混淆对引擎标注的负面影响，再从可用性、有效性和鲁棒性评估各引擎在多种混淆技术下的表现，分类并筛选出抗混淆引擎。实验表明，当训练集混入 50% 混淆样本时，在 Drebin 和 Malscan 上，使用所选引擎比使用全部引擎分别提升检测性能 15.21% 和 19.23%。
With the widespread application of machine learning-based Android malware detection methods, building a high-quality dataset has become increasingly important. Existing large-scale datasets are mostly annotated with VirusTotal by aggregating the decisions of antivirus engines, and most of them indiscriminately accept the decisions of all engines. In reality, however, these engines have different capabilities in detecting malware, especially those that have been obfuscated. Previous research has revealed that code obfuscation degrades the detection performance of these engines to varying degrees. This makes us believe that using all engines indiscriminately is unreasonable for dataset annotation. Therefore, in this paper, we first conduct a data-driven evaluation to confirm the negative effects of code obfuscation on engine-based dataset annotation. To gain a deeper understanding of the reasons behind this phenomenon, we evaluate the availability, effectiveness and robustness of every engine under various code obfuscation techniques. Then we categorize the engines and select a set of obfuscation-robust engines. Finally, we conduct comprehensive experiments to verify the effectiveness of the selected engines for dataset annotation. Our experiments show that when 50% obfuscated samples are mixed into the training set, on the classic malware detectors Drebin and Malscan, using our selected engines can effectively improve detection performance by 15.21% and 19.23%, respectively, compared to using all the engines.
DOI 原文 ·
@inproceedings{paperbot8469,
title = {Uncovering and Mitigating the Impact of Code Obfuscation on Dataset Annotation with Antivirus Engines},
author = {Gao Cuiying and Yueming Wu and Heng Li and Wei Yuan and Haoyu Jiang and Qidan He and Yang Liu},
booktitle = {ISSTA},
year = {2024},
doi = {10.1145/3650212.3680302}
}